CVE-2025-61669

Jupyter Server, the backend for Jupyter web applications, prior to version 2.21.0 copies the Referer header into a JSON header block in the 5xx request logging path without applying the token scrubbing used for the request URI. A request returning HTTP 500 whose Referer contains a token-bearing URL can write that token to server logs in plaintext.

Jupyter Server prior to version 2.20 has a stored XSS vulnerability in nbconvert handlers. A notebook with an HTML payload in display_data output can lead to cookie theft, full API access, and kernel RCE.

In jupyter-server versions 1.12.0 through 2.17.0, a vulnerability allows bypassing CORS origin validation when using `allow_origin_pat`. The issue is due to `re.match()` only anchoring at the start, allowing attacker-controlled domains like `trusted.example.com.evil.com` to pass validation for patterns intended for `trusted.example.com`. This affects CORS headers, WebSocket connections, referer validation, and login redirects, potentially enabling phishing, arbitrary code execution, and unauthorized access to sensitive API responses.

A path traversal vulnerability in jupyter-server 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function. This allows unauthorized read/write access to files in sibling directories.

Jupyter Server up to version 2.17.0 persists the secret used to sign authentication cookies to a static file and does not rotate it after a password change. After a password reset and server restart, previously issued cookies remain valid, allowing an attacker who captured a session cookie to retain access despite the password change.

Jupyter Server versions 2.17.0 and earlier use re.match() for Origin header validation, allowing bypass of CORS restrictions. An attacker controlling a domain like trusted.example.com.evil.com can make cross-origin requests to the server API.

Jupyter Server versions 2.17.0 and earlier contain a path traversal vulnerability in the REST API that allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments with predictable naming schemes are particularly at risk. Version 2.18.0 contains a fix.

In jupyter-server, improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents or accessing files when opening untrusted files. This issue has been addressed in version `2.7.2`.

The vulnerability in jupyter-server allows for an Open Redirect attack, enabling redirection of users to arbitrary sites after logging into a Jupyter server. Maliciously crafted login links can lead to unauthorized redirects.